3-Tier installation and external domain trust

Pepri

Hello,
my setup is 3-Tier installation of NAV 2008 R2 with users on the external trust domain.
This is my setup:
DB1 - SQL Server 2008
NAV-Server - Windows Server 2008 R2 Datacenter
RTC client server - Windows Server 2008

All the servers are in domain A. All the users are in domain B. There is two-way external trust between domains.

Goal
I want users from domain B to be able to use NAV using RTC installed on domain A server. Users from domain B can logon successfully to RTC client server on domain B but they can't use NAV. The error message is: "The user ID and password are invalid. Try again."

I've verified the installation using Domain A administrator account.

I'm newbie in Navision so is this even possible? Can I login using user account from another domain through domain trust?

BR,
Pepri

bbrown

NAV has never supported domain trust. AFAIK this continues to be true with the RTC.

kine

We had never problems with using two domains in trust with classic client... but I think with RTC there could be problem with the SPNs...

bbrown

kine wrote:

We had never problems with using two domains in trust with classic client... but I think with RTC there could be problem with the SPNs...

I've never tried it so I can't say whether it works or not. AFAIK separate domains is not and has never been offically supported. But then again many things that are not supported work. This is not to be confused with multiple domaisn under the same parent domain. This works and is supported.


We are talking Window Authentication here?

kine

Yes, just two separate domains, with trust between them... we were using this when changing name of our internal domain (after company rename). BUt with RRC and the delegations and SPNs, I thing this will be the critical thing, how to set the delegation correctly...

Pepri

Addition for my previous post.
A regular user from Domain A can use RTC.

kine

I think that the problem is that in domain B there is no SPN which will allow the service tier to delegate the authentication into domain B...

Pepri

Thanks Kine,

good point!